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Arguments to Accompany the Pre- Appeal Brief Request for Review 



Applicants hereby submit the following Arguments, in five (5) or less total 
pages, as attachment to the Pre- Appeal Brief Request for Review Form (PTO/SB/33). 
A Notice of Appeal is concurrently filed. 



Applicants' arguments in the Amendment and Reply under 37 C.F.R. § 1.111 
filed March 17, 2009 ("Reply"), filed in response to the Office Action mailed 
December 17, 2008 ("Office Action"), were not properly considered by the Examiner 
in the Final Office Action mailed July 7, 2009 ("Final OA"). Moreover, Applicants' 
arguments in the Reply under 37 C.F.R. § 1.116 filed on August 25, 2009 ("AF 
Reply"), were not properly considered or responded to by the Examiner in the 
Advisory Action mailed September 9, 2009 ("Advisory Action"). The Examiner's 
response was legally and factually deficient because the Examiner failed to show that 
the cited references taught each and every feature of independent claims 1,5, and 35- 
39 and failed to show it would have been obvious to modify the cited combination to 
achieve Applicants' claims. 

The Final OA rejected claims 1, 5, and 35-39 under 35 U.S.C. § 103(a) as 
being allegedly unpatentable over U.S. Patent Number 5,623,500 to Ji, et al ("Ji") in 
view of U.S. Patent Number 5,696,822 to Nachenberg ("Nachenberg"). All of 
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Applicants' previous arguments in the Reply and AF Reply are incorporated by 

reference, and not fully repeated for brevity. 

Independent claims 1, 5, and 35-39 recite features that distinguish over the 

cited references. Independent claims 1, 35, and 37 recite, for example (only most 

relevant portions shown): 

"updating]" and "maintain [ing]" "the model ... prior to receiving the 
computer data" "based on pre-existing information on the second 
computer" 

Independent claims 5, 36, and 38 recite, for example: 

"[a] model ... maintained and updated prior to receiving the computer 
data, based on pre-existing information on the second computer" 

Independent claim 39 recites, for example: 

maintaining the model of the destination computer prior to receiving 
data destined for the destination computer, based on the status update 
communication; analyzing data destined for the destination computer to 
determine whether the data includes a virus 

At page 3 of the Final Office Action mailed July 7, 2009, the Examiner states 

that Ji fails to disclose or suggest: 

wherein the intermediary computer is a model of the second computer and 
receiving at a model of a second computer a status update communication 
from the second computer[,] the status update communication including pre- 
existing information on the second computer; updating and maintaining the 
model based on the status update communication^] to reflect any changes to 
the second computer. 

Rather, the Examiner relies on Nachenberg to allegedly remedy the deficiencies of Ji. 

At page 3 of the Advisory Action, the Examiner states: 

Nachenberg clearly teaches receiving, at a model of a second 
computer, a status update communication from the second 
computer, the status update communication including pre- 
existing information on the second computer in column 10 
lines 12-57 i.e. Method 400 begins by initializing 410 a 
virtual machine for emulating files in isolation from the host 
computer and updating and maintaining the model based on 
the status update communication, to reflect any changes to 
the second computer in column 10 lines 12-57 i.e. initiating 
410 a virtual machine for emulating files in isolation from 
the host computer. 
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Applicants believe these statements of the Examiner, which go well beyond 
anything actually disclosed in Nachemberg, absent the improper use of speculation, 
conjecture, or hindsight by the Examiner, constitute a clear error of the Examiner. 

FIG. 4A of Nachenberg illustrates an emulation process that includes a single 
preparing step 410 before running all virus checks. Even if the preparing step 410 
can be considered the claimed maintaining, or one of the claimed updating or 
maintaining, as recited in claims 1, 5, and 35-38, which Applicants do not concede, 
the preparing step 410 cannot also be used by the Examiner to perform at least the 
claimed maintaining, as recited in claims 1, 5, and 35- 39 or the claimed maintaining 
and updating, as recited in claims 1, 5, and 35-38, because Nachenberg does not 
teach or suggest an additional operation that could reasonably be interpreted as the 
additional claimed operation of maintaining. 

Nachenberg teaches beginning with step 410: "Prepare Virtual Machine 
(Emulator)," and proceeding directly to step 414: "Load Next File," (Nachenberg, 
FIG. 4A, steps 410 and 414.) Nacheneberg teaches "If all known viruses have been 
excluded 420 at step 418, the target file is deemed infection- free 440 and the next 
target file is loaded 414 for emulation." (Nachenberg, Col 10, lines 20-26.) Thus, 
Nachenberg's loop 414, 418, 420, 440, and 414 fails to disclose or suggest that the 
virtual machine is "maintained" or "maintained and updated," as recited, using 
respective language, in the independent claims. This is because, as is explicitly 
taught, Nachenberg does not maintain the virtual machine prior to loading subsequent 
files for analysis, e.g., between step 440 and step 414, since it is clear that only one 
"preparing" step 410 is performed in Nachenberg for all future virus scannings and is 
never repeated again. 

The suggestions in both the Final OA and Advisory that the initializing or 
preparing step 410 of the virtual machine in Nachenberg includes at least the claimed 
maintaining or both the claimed maintaining and updating, as is respectively recited 
in the claims, is nothing more than mere speculation and conjecture with no support, 
either explicitly or implicitly, in Nachenberg, i.e., based on improper hindsight. 
Applicants continue to assert there is no teaching or suggestion in Nachenberg that 
could be construed to teach or suggest the claimed maintaining, as recited in claim 
39, or both the claimed maintaining and updating of the model, as recited using 
respective language in claims 1, 5 and 35-38. Absent this support in Nachenberg, the 
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rejection is improper under current case law and Board decisions and cannot be 
maintained, per our AF Reply arguments in view of KSR (see page 14 of the AF 
Reply), In re Warner (see page 15 of the AF Reply), In re Kahn (see page 15 of the 
AF Reply), and Ex Parte Kamran Ahmed (see page 15 of the AF Reply). Further, 
there is no inherent teaching in Nachenberg as to these features (see page 15 of the AF 
Reply). 

Therefore, as Nachenberg, without improperly relying on speculation, 
conjecture, inherency, or hindsight, does not cure the noted deficiencies of Ji, the 
applied references cannot be used to establish a prima facie case of obviousness for 
claims 1, 5, and 35-39. 



In view of the foregoing, Applicants respectfully request reconsideration and 
withdrawal of the rejection under 35 U.S.C. § 103(a) of claims 1, 5, and 35-39. 
Additionally, at least based on their respective dependencies to claims 1 and 5, claims 
2, 3, 6, 8-10, 14, 15, and 19-34 should be found allowable, as well as for their 
additional distinguishing features. 

The U.S. Patent and Trademark Office is hereby authorized to charge any fee 
deficiency, or credit any overpayment, to our Deposit Account No. 19-0036. 



Conclusion 



Respectfully submitted, 
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